nodepack-daemon@1.2.9

Analysis

nodepack-daemon@1.2.9 is a trojanized clone of the pino logger package. When the package is required, index.js spawns a detached background Node.js process (child_process.spawn with detached:true and stdio:"ignore") that runs lib/caller.js. That script fetches a remote payload from hxxps://jsonkeeper[.]com/b/QWPQX via HTTP GET (with a custom header "x-secret-key") and executes the response body using the Function constructor with full access to Node's require(), enabling arbitrary code execution on the installer's machine. The C2 host is jsonkeeper[.]com, path /b/QWPQX.